import "elf"

rule canvasspectre {
  meta:
    author = "Tim Brown @timb_machine"
    description = "Hunts for CANVAS Spectre"
  strings:
    $inode_hashtable = "inode_hashtable"
    $a20f = { a2 0f }
  condition:
    $inode_hashtable and $a20f and (elf.number_of_sections >= 1)
}
